Improper Verification of Cryptographic Signature in jsrsasign by Kjur

CVE-2026-4600

What is CVE-2026-4600?

The jsrsasign library, specifically versions prior to 11.1.1, has a critical vulnerability that arises from improper verification of cryptographic signatures. The flaw exists due to inadequate validation of DSA domain parameters in the KJUR.crypto.DSA.setPublic function. This weakness allows an attacker to forge DSA signatures or X.509 certificates that can bypass verification checks. By manipulating parameters such as g=1, y=1, and a fixed r=1, an attacker can satisfy the verification equation for any hash, leading to potential security breaches.

References